- Home
- IPTV Admin Panel
- Security
Xtream-Masters OTT panel feature: security
IPTV Panel Security and DDoS protection
Xtream-Masters is a self-hosted IPTV / OTT panel for Ubuntu 20.04 to 26.04 that protects every server with Server Guard, hides the admin, reseller and MAG portal logins behind access codes, and locks customer lines against sharing.
Server Guard filters Layer-7 DDoS, brute-force and API abuse on the main server and on every load balancer, and can whitelist your SSH and database ports.
- Server Guard on every server
- Access code logins
- ISP lock against sharing
Security at a glance
- Server GuardMain + every load balancer
- Panel loginsAccess code links
- SSH and databaseIPv4 whitelist
- Line sharingISP lock, VideoLog, ActiveCode
- Server IPsHidden behind proxies
- Price€40/mo, €70/mo from 2027
How does Xtream-Masters protect an IPTV panel?
Xtream-Masters protects an IPTV panel in layers. Server Guard filters Layer-7 DDoS, brute-force and API abuse on every server and whitelists SSH and database ports. Access codes hide the admin, reseller and MAG portal logins. Auto ISP lock, VideoLog and ActiveCode stop subscription sharing.
Xtream-Masters is a self-hosted IPTV/OTT panel (Xtream UI / XUI.ONE replacement) that installs on your own Ubuntu server and migrates Xtream UI, XUI, NXT and other panel databases by remote database or mysqldump file.
| Server Guard | Main server and every load balancer: I'm under attack mode, botnet fighter, IP whitelisting |
|---|---|
| Whitelisted ports | 22 (SSH), 3306 and 7999 (database), 7709, 25460 (Redis), IPv4 only |
| Never blocked | Streaming and panel ports 80, 8080, 443, 8443 and custom ports |
| Attack signs | 500+ requests/s on the main, 200+ requests/s on a load balancer |
| Panel login | Access code link only, direct login page disabled |
| Sharing controls | Auto ISP lock, VideoLog, ActiveCode, same IP detection, stream fingerprint |
| Price | €40/month until 31 Dec 2026, then €70/month from 1 January 2027 |
Five layers of IPTV server security
From the network edge down to a single customer line. Each layer is set from the admin panel.
1. Network edge
Keep floods away from your real servers2. Server Guard
On the main and on every load balancer3. Panel access
Who can log in, and from where4. Line protection
Stop one login turning into dozens of users5. Content protection
Trace leaks and hide your sourcesFor panel-side attack handling, the official FAQ recommends access codes first, then Multi-Main if large floods still slow the main server at peak time.
IPTV DDoS protection: what to do during an attack
The four steps from the official Xtream-Masters FAQ, in order.
-
1
Servers page
Confirm the attack
Read Request per sec: 500+ on the main or 200+ on a load balancer means an attack.
-
2
Server Guard tab
Turn on Server Guard
Edit the main or load balancer, enable Server Guard, I'm under attack mode and the botnet fighter.
-
3
Xtream tab
Cut heavy EPG calls
In General Settings, set Disable XML EPG and Disable Player_API EPG to ON and save.
-
4
BruteForce Attacks tab
Set flood rules
Enable all checkboxes, then watch the blocked IP page so you do not block your own restreamers.
| BruteForce Attacks setting | FAQ value |
|---|---|
| Requests Amount for Blacklist | 25 |
| In Seconds | 5 |
| Requests Within Seconds | 10 |
| Flood Limit | 30 |
Access codes and SSH IP whitelist
Hide the login pages and close the admin ports to everyone except you.
Access codes for panel logins
- System Security > Access Code: enable access code feature for panel logins and disable panel login page without access code link.
- Create codes for admin groups, then repeat for the reseller panel. Separate codes per reseller type show where an attack comes from.
- A MAG portal access code disables the default
/caddress automatically. - Share only links like
yourdomain.tld:port/ac_XXXXXXX. Lost it? Master CMS > Profile > AccessCode.
Server Guard IP whitelist
- Manage Servers > Main Server > Server Guard > Whitelist IPs: add your fixed IPv4 and every load balancer IP.
- Covers ports 22, 3306, 7999, 7709 and 25460. Unlisted IPs are dropped silently.
- Viewers are never affected: 80, 8080, 443, 8443 and custom streaming ports stay open.
- Dynamic home IP? Connect through a fixed-IP VPN or server, or keep Server Guard on with IP Whitelisting off.
Protect lines against sharing and leaks
Credentials leak through friends, social media groups and untrusted player sites. These controls are built in.
Auto ISP Lock
Records the viewer's ISP on first login and blocks other ISPs. Reset per line, or for everyone with Tools > Reset all ISPs.
Connections Exceed VideoLog
Instead of an error, the viewer sees a video with active sessions and attempts, so shared lines get noticed and the password changed.
ActiveCode device binding
Each activation code binds to one device. Read the IPTV anti-sharing guide.
Same IP detection
Detect multiple users streaming from the same IP and spot multi-login abuse in real time.
Stream fingerprint
Invisible fingerprints on streams trace unauthorized redistribution back to the source subscriber.
Hide VOD source URL
Movies and series stream through your server, so the original provider URLs stay hidden.
Apps lock
Lock subscriptions to specific apps and control which players can access your service.
MAG security and auto-block
MAG Security in the Stalker Portal tab. A MAC that floods the server with requests is blocked for 7 days automatically.
Activity and abuse logs
Members Activity Logs and Members Login Logs show who did what, from which IP and when. Abused Subscriptions lists abused lines.
Unknown changes in your panel? Five steps
The panel never deletes users or edits settings on its own. Every change comes from a login or an API key, and every action is logged.
| Step | Where in the panel |
|---|---|
| 1. Find who did it | Menu > Members Logs > Members Activity Logs and Members Login Logs (member, IP, time) |
| 2. Check admin power | Menu > Members > Manage Register Users and Member Groups, remove unexpected admin rights |
| 3. Revoke API access | Menu > Admin API, revoke every key you are not actively using |
| 4. Change passwords | Your Admin ID and every admin or sub-admin account, strong and unique |
| 5. Enable Access Code | Menu > System Security > Access Code on your admin IDs |
IPTV panel security questions
Short answers taken from the official Xtream-Masters FAQ.
Does the Xtream-Masters IPTV panel have DDoS protection?
Yes. Server Guard runs on the main server and on every load balancer and filters Layer-7 DDoS, brute-force and API abuse, with an I'm under attack mode and a botnet fighter. For very large floods at peak time, the optional Multi-Main add-on serves playlist, EPG and portal requests from Sub-Main edge nodes, so the flood does not reach the main server.
How do I know my IPTV server is under a DDoS attack?
Open the Servers page and read Request per sec. 500 or more on the main server, or 200 or more on a load balancer, almost always means a DDoS or brute-force attack. Then enable Server Guard, I'm under attack mode and the botnet fighter, and turn on the BruteForce Attacks rules.
What are access codes in the IPTV panel?
An access code is a secret login link such as yourdomain.tld:port/ac_XXXXXXX. In System Security > Access Code, enable access codes for panel logins and disable the login page without a code. Create codes for admin, reseller, MAG portal and API endpoints. A lost code is reset in the Master CMS panel under Profile > AccessCode.
Why can I not connect by SSH to my main server after an update?
Usually Server Guard IP Whitelisting is on and your IP is not listed, so ports 22, 3306, 7999, 7709 and 25460 drop your connection while viewers keep playing. Add your public IPv4 in Manage Servers > Main Server > Server Guard > Whitelist IPs. The rules refresh within a minute, and the panel itself still works from any IP.
How do I stop IPTV subscription sharing?
Turn on Auto ISP Lock in General Settings > Streaming (Enable ISP's and Enable ISP Lock), then Whitelist ISP per line under Restrictions. Enable Connections Exceed VideoLog to show viewers their active sessions instead of an error. For devices, use ActiveCode, which binds each code to one device.
Someone changed users or settings in my panel. What should I do?
The panel never deletes users or edits settings on its own, every change comes from a login or an Admin API key. Check Members Activity Logs and Members Login Logs, review admin members and groups, revoke unused Admin API keys, change every admin password and enable Access Code on admin IDs.
Can I hide my load balancer IPs from attackers?
Yes. Use the built-in Install Proxy page to put a proxy in front of each load balancer and one in front of the main server, then point your streaming DNS to the proxy. Attacks hit the proxy instead of the streaming server, and a burned proxy IP is easy to replace. Each proxy needs the same or higher bandwidth than the balancer it protects.
A secure IPTV panel on your own server
Install the Xtream-Masters panel on a fresh Ubuntu server, turn on Server Guard and access codes, and migrate your old database.